Identity management system

ABSTRACT

Identity management is disclosed that allows authentication of a user for a third party by way of an encrypted token. A biometric signature can be requested for a user of a user device. In response, an encrypted token can be generated based at least in part on the biometric signature. The encrypted token can then be provided back to the user device, which can save the encrypted token to a secure location on the user device accessible by biometric authentication of the user on the user device. An authentication request can be provided from a third party which includes an encrypted token. A determination can be made regarding whether user identity can be confirmed based on the encrypted token. An indication of whether the user identity was confirmed or unconfirmed can then be communicated in response to the authentication request.

CROSS REFERENCE TO RELATED APPLICATIONS

This application is a continuation of U.S. patent application Ser. No.16/180,76, filed Nov. 5, 2018, and entitled “IDENTITY MANAGEMENTSYSTEM,” which is a continuation of U.S. application Ser. No. 14/972,986filed on Dec. 17, 2015 and entitled “IDENTITY MANAGEMENT SYSTEM.” Theentireties of the above applications are incorporated herein byreference.

BACKGROUND

As e-commerce and electronic communications continue to grow so does theconcern about consumer privacy and the threat of electronic theft andfraud. Current systems and communications use user ID's and passwords toprovide means of security. These security measures, however, do notprovide adequate privacy for consumers who wish to protect theirprivacy. In addition, these security measures do not provide adequateprotection from online threats and third-party data breach for bothconsumers and financial institutions.

SUMMARY

The following presents a simplified summary of the innovation in orderto provide a basic understanding of some aspects of the innovation. Thissummary is not an extensive overview of the innovation. It is notintended to identify key/critical elements of the innovation or todelineate the scope of the innovation. Its sole purpose is to presentsome concepts of the innovation in a simplified form as a prelude to themore detailed description that is presented later.

In accordance with one aspect of the disclosure, a system comprises aprocessor coupled to the memory that includes instructions that whenexecuted by the processor cause the processor to request a biometricsignature for a user from a user device, generate an encrypted tokenbased at least in part on the biometric signature, and return theencrypted token to the user device that saves the encrypted token to asecure location on the user device accessible by biometricauthentication of the user on the user device. The instructions canfurther cause the processor to determine whether user identity can beconfirmed based on a received encrypted token in conjunction with avalidation request from a third party and communicate whether the useridentity was confirmed or unconfirmed in response to the validationrequest. In one instance, the encrypted token comprises the biometricsignature of the user, and instructions can cause the processor todecrypt the encrypted token and compare the biometric signature of theencrypted token with the biometric signature of the user to determinewhether the user identity is confirmed.

In accordance with another aspect, a method is disclosed that comprisesrequesting a biometric signature for a user from a user device,generating an encrypted token based at least in part on the biometricsignature, and providing the encrypted token to the user device thatsaves the encrypted token to a secure location on the user deviceaccessible by biometric authentication of the user on the user device.Further the method comprises determining whether user identity can beconfirmed based on a received encrypted token in conjunction with anauthentication request from a third part and communicating whether theuser identity was confirmed or unconfirmed in response to theauthentication request. The method can further comprise decrypting theencrypted token to revealing a biometric signature and comparing thebiometric signature of the encrypted token with the biometric signatureof the user to determine whether the user is confirmed. In one instance,the method can further comprise communicating data regarding the userwith confirmation of the user identity.

According to yet another aspect, a method is disclosed that comprisesexecuting, on a processor, instructions that cause the processor toperform operation. The operations comprise requesting a biometricsignature of a user from a user device, generating an encrypted tokenbased at least in part on the biometric signature, and providing theencrypted token to the user device that saves the encrypted token to asecure location on the user device accessible by biometricauthentication of the user on the user device. Further, the operationscomprise decrypting a received encrypted token in conjunction with anauthentication request from a third party to reveal a biometricsignature, confirming identity of the user when the biometric signaturematches the biometric signature of the user, and communicatingconfirmation of the identity of the user in response to theauthentication request.

To the accomplishment of the foregoing and related ends, certainillustrative aspects of the innovation are described herein inconnection with the following description and the annexed drawings.These aspects are indicative, however, of but a few of the various waysin which the principles of the innovation may be employed and thesubject innovation is intended to include all such aspects and theirequivalents. Other advantages and novel features of the innovation willbecome apparent from the following detailed description of theinnovation when considered in conjunction with the drawings.

BRIEF DESCRIPTION OF THE DRAWINGS

FIG. 1 is a block diagram illustration of an e-commerce system inaccordance with an aspect of the innovation.

FIG. 2 is a non-limiting illustration of user device shown in blockdiagram form in accordance with an aspect of the innovation.

FIG. 3 is a non-limiting illustration of an identity management systemshown in block diagram form in accordance with an aspect of theinnovation.

FIG. 4 is a non-limiting illustration illustrating an operation of theidentity management system in accordance with an aspect of theinnovation.

FIG. 5 is a non-limiting illustration illustrating an operation of analternative embodiment of the identity management system in accordancewith an aspect of the innovation.

FIGS. 6A, 6B, and 6C illustrate example, non-limiting block diagrams ofa method of facilitating electronic transactions in accordance with anaspect of the innovation.

FIG. 7 illustrates an example, non-limiting computer-readable medium orcomputer-readable device including processor-executable instructionsconfigured to embody one or more of the aspects set forth herein.

FIG. 8 illustrates an example, non-limiting computing environment whereone or more of the aspects set forth herein are implemented, accordingto one or more aspects.

DETAILED DESCRIPTION

The innovation is now described with reference to the drawings. In thefollowing description, for purposes of explanation, numerous specificdetails are set forth in order to provide a thorough understanding ofthe subject innovation. It may be evident, however, that the innovationmay be practiced without these specific details. In other instances,well-known structures and devices are shown in block diagram form inorder to facilitate describing the innovation.

As used herein, the term “inference” or “infer” refers generally to theprocess of reasoning about or inferring states of the system, acomponent, a module, the environment, and/or user devices from a set ofobservations as captured through events, reports, data and/or throughother forms of communication. Inference may be employed to identify aspecific context or action, or may generate a probability distributionover states, for example. The inference may be probabilistic. Forexample, computation of a probability distribution over states ofinterest based on a consideration of data and/or events. The inferencemay also refer to techniques employed for composing higher-level eventsfrom a set of events and/or data. Such inference may result in theconstruction of new events and/or actions from a set of observed eventsand/or stored event data, whether or not the events are correlated inclose temporal proximity, and whether the events and/or data come fromone or several events and/or data sources. Various classificationschemes and/or systems (e.g., support vector machines, neural networks,logic-centric production systems, Bayesian belief networks, fuzzy logic,data fusion engines, and so on) may be employed in connection withperforming automatic and/or inferred action in connection with thedisclosed aspects.

Referring now to the drawings, FIG. 1 is a block diagram illustration ofan e-commerce system 100 utilizing an electronic user device (e.g.,computer, mobile phone, tablet, etc.) 200 and incorporating aninnovative identity management system 300 that overcomes the abovementioned disadvantages by using a trusted authoritative identity source(e.g., government agency, financial institution, credit bureau, etc.)400 to validate an identity of a user of the electronic device 200 forthird party entities (e.g., a business, corporation, merchant, financialinstitution, any e-commerce entity, etc.) 500. The innovative identitymanagement system 300 improves identity validation via the user device200 by providing an improved secure validation process therebyfacilitating e-commerce transactions that require identityvalidation/verification, such as but not limited to, on-line transfers,on-line purchases, etc. It is to be understood that although theinnovative identity management system is described and illustrated witha separate identity source and third party entity, in an alternativeembodiment, the identity source and third party entity may be one in thesame.

Referring to FIG. 2 , the user device 200 includes a biometric module202 and a secure enclave module 204. The biometric module 202 allows theuser to generate (e.g., scan, download, etc.) a biometric signature(print) 206 (see also FIG. 4 ) of the user and place the biometricsignature onto the user device 200. The biometric signature 206 mayinclude any biometric, such as but not limited to, fingerprint, palmprint, palm veins, hand geometry, face recognition, iris and/or retinarecognition, voice, gait, scent, etc. As will be explained furtherbelow, the secure enclave module 204 stores a token generated by theidentity source 400.

FIG. 3 is a block diagram illustration of the identity management system300 in accordance with an aspect of the innovation. The identitymanagement system 300 may include at least one memory 310 that may storecomputer executable components and/or computer executable instructions.The identity management system 300 may also include at least oneprocessor 320, communicatively coupled to the at least one memory 210.The at least one processor 320 may facilitate execution of the computerexecutable components and/or the computer executable instructions storedin the memory 310. The term “coupled” or variants thereof may includevarious communications including, but not limited to, directcommunications, indirect communications, wired communications, and/orwireless communications (e.g., with specialized banking machines andsystems).

It is noted that although the one or more computer executable componentsand/or computer executable instructions may be illustrated and describedherein as components and/or instructions separate from the memory 310(e.g., operatively connected to the memory 310), the various aspects arenot limited to this implementation. Instead, in accordance with variousimplementations, the one or more computer executable components and/orthe one or more computer executable instructions may be stored in (orintegrated within) the memory 310. Further, while various componentsand/or instructions have been illustrated as separate components and/oras separate instructions, in some implementations, multiple componentsand/or multiple instructions may be implemented as a single component oras a single instruction. Further, a single component and/or a singleinstruction may be implemented as multiple specialized components and/oras multiple instructions without departing from the example embodiments.

Still referring to FIG. 3 and also to FIG. 4 , the identity managementsystem 300 may include a registration component 330 that allows a userto enroll or register 332 their electronic device(s) 200 with theidentity source 400. The user registers their user device 200 with theidentity source 400 with their biometric signature 206 described above.In other words, the biometric signature 206 of the user is transmittedand stored with the identity source 400.

The identity management system 300 further includes a secure elementgeneration component 340. Once the user device 200 is registered, theidentity source 400 generates an encrypted user identity element 342(e.g., token, key (Public Key Infrastructure (PKI) using public keycryptography), etc.). The encrypted secure element 342 facilitatessecure identification of the user. The identity source 400 thentransmits 344 the encrypted user identity element 342 to the user device200 where the user device stores the encrypted user identity element 342onto the secure enclave 204 of the user's device 200. The encrypted useridentity element 342 incorporates a hashed biometric print of the usersuch that the encrypted user identity element 342 embodies the biometricsignature 206 of the user that was used to register the user device 200.Thus, as will be explained further below, the identity source 400compares the biometric signature 206 on the encrypted user identityelement 342 with the stored biometric signature to validate the identityof the user.

The identity management system 300 further includes an identity requestcomponent 350 that allows third party entities 500 to send an identityrequest (IR) requesting proof of identity of the user of the user device200. Thus, the third party entity 500 is requesting access to theencrypted user identity element 342. As shown in FIG. 4 , one or morethird party entities (for example, Entities 500A, 500B, 500C) may sendseparate and independent identity requests 352A, 352B, 352C to the userdevice 200 requesting proof of identity of the user. The user thenunlocks the secure enclave 204 of the user device 200 by inputting theirbiometric signature into the user device 200. The user device 200 thenseparately and independently transmits 354A, 354B, 354C the encryptedsecure element 342 to any third party entity 500 (e.g., third partyentities 500A, 500B, 500C) requesting proof of identity.

The identity management system 300 further includes avalidation/authentication component 360 that allows the third partyentities 500 to validate the identity of the user of the user device 200via the identity source 400. For example, after the user transmits theencrypted user identity element 342 to the third party entities 500A,500B, 500C, as mentioned above, the third party entities 500A, 500B,500C transmit a validation request 362A, 362B, 362C to the identitysource 400. The validation request 362 comprises transmitting theencrypted user identity element 342 to the identity source 400. Theidentity source 400 compares the biometric signature on the encrypteduser identity element 342 with the biometric signature 206 registeredwith the user device 200. If the two biometric signatures match, theidentity source 400 transmits a validation 364A, 364B, 364C to thethird-party entities 500A, 500B, 500C confirming the identity of theuser of the user device 200.

The validation may or may not include additional information about theuser, such as but not limited to, a credit score, credit history, a riskscore, etc. If the two biometric signatures do not match, the identitysource 400 transmits an invalidation signal to the entities 500A, 500B,500C that the user is not the user of the user device 200. Asillustrated in FIG. 4 , each third-party entity (Entities A-C) 500transmits and receives their own independent validation request andvalidation response respectively.

Still referring to FIG. 3 , the identity management system 300 mayfurther include a transaction component 370 in accordance with an aspectof the innovation. The transaction component 370 facilitates electronictransactions between the user device 200, the identity source 400, andthe third-party entities 500, as described herein.

In an alternative embodiment illustrated in FIG. 5 , each third partyentity 500 may store their own secure element (e.g., key, token asdescribed herein) hereinafter referred to as an encrypted entity element502 in the secure enclave 204 on the user device 200. Thus, the securedenclave 204 stores both the encrypted user identity element 342 providedby the identity source 400 described above and the encrypted entityelement 502 placed on the user's device 200 by the third-party entity500. Therefore, during the validation process, the biometric signatureof the encrypted user identity element 342 and a biometric signature ofthe encrypted entity element 502 must match the biometric signatureregistered with the identity source 400 and the encrypted entity element502. In this embodiment, in the event of a security compromise of theuser identity or user device, the third-party entities 500 can updateencrypted entity element 502 (e.g., rotate the tokens/key) as needed tosecure the third party access.

Referring to FIGS. 6A, 6B, and 6C, methods that may be implemented inaccordance with the disclosed subject matter will be better appreciatedwith reference to the flow charts. While, for purposes of simplicity ofexplanation, the methods are shown and described as a series of blocks,it is to be understood and appreciated that the disclosed aspects arenot limited by the number or order of blocks, as some blocks may occurin different orders and/or at substantially the same time with otherblocks from what is depicted and described herein. Moreover, not allillustrated blocks may be required to implement the disclosed methods.It is to be appreciated that the functionality associated with theblocks may be implemented by software, hardware, a combination thereof,or any other suitable means (e.g. device, system, process, component,and so forth). Additionally, it should be further appreciated that thedisclosed methods are capable of being stored on an article ofmanufacture to facilitate transporting and transferring such methods tovarious devices. Those skilled in the art will understand and appreciatethat the methods might alternatively be represented as a series ofinterrelated states or events, such as in a state diagram.

The various aspects (e.g., in connection with automatic implementationof various portions of actions/events, completion of a prioraction/event, and so forth) may employ various artificialintelligence-based schemes for carrying out various aspects thereof. Forexample, a process for determining if a particular action should followa current action may be enabled through an automatic classifier systemand process.

A classifier is a function that maps an input attribute vector, x=(x1,x2, x3, x4, xn), to a confidence that the input belongs to a class. Inother words, f(x)=confidence (class). Such classification may employ aprobabilistic and/or statistical-based analysis (e.g., factoring intothe analysis utilities and costs) to forecast or infer an action thatshould be employed to determine what actions should be automaticallyperformed what actions should be performed after receiving confirmationfrom the user to proceed. In the case of actions/events, for example,attributes may be identification of a user device and/or the user andthe classes are criteria related to known information (e.g., historicalinformation) about the user device and/or user.

A support vector machine (SVM) is an example of a classifier that may beemployed. The SVM operates by finding a hypersurface in the space ofpossible inputs, which hypersurface attempts to split the triggeringcriteria from the non-triggering events. Intuitively, this makes theclassification correct for testing data that may be similar, but notnecessarily identical to training data. Other directed and undirectedmodel classification approaches (e.g., naïve Bayes, Bayesian networks,decision trees, neural networks, fuzzy logic models, and probabilisticclassification models) providing different patterns of independence maybe employed. Classification as used herein, may be inclusive ofstatistical regression that is utilized to develop models of priority.

One or more aspects may employ classifiers that are explicitly trained(e.g., through a generic training data) as well as classifiers that areimplicitly trained (e.g., by observing fraud trends, by receivingextrinsic information, and so on). For example, SVM's may be configuredthrough a learning or training phase within a classifier constructor andfeature selection module. Thus, a classifier(s) may be used toautomatically learn and perform a number of functions, including but notlimited to determining according to a predetermined criteria when toprovide a suggested action (e.g., take medication), when to complete acurrent action, which actions to implement in sequence, and so forth.The criteria may include, but is not limited to, historical information,user preferences, expected actions, and so forth.

Additionally or alternatively, an implementation scheme (e.g., a rule, apolicy, and so on) may be applied to control and/or regulate events andresulting recommendations, subsequent events, and so forth. In someimplementations, based upon a predefined criterion, the rules-basedimplementation may automatically and/or dynamically implement one ormore portions of an event/action. In response thereto, the rule-basedimplementation may automatically interpret and carry out functionsassociated with the event/action by employing a predefined and/orprogrammed rule(s) based upon any desired criteria.

FIGS. 6A, 6B, and 6C are non-limiting block diagram illustrations 600A,600B, 600C of a method of validating a user identity in an e-commercetransaction using an authoritative identity source in accordance with anaspect of the innovation. At 602, the user places (e.g., scans,downloads, etc.) at least one of their biometric signatures 206 ontotheir user device 200. At 610, the user registers their biometricsignature 206 with the identity source 400, as defined herein. At 620,the identity source 400 generates the encrypted user identity element342, as described herein. At 630 the encrypted user identity element 342is transmitted to the user device 200. At 640, the user device 200stores the encrypted user identity element 342 in the secure enclave 204of the user device 200. At 650, the third party entity 500 transmits anidentity request 352 to the user device 200. At 660, the user unlocksthe secure enclave 204 of the user device 200 via the biometric module202 on the user device 200, thereby allowing the third party entity 500access to the user identity element 342 stored in the secure enclave204. At 670, the user device 200 transmits the encrypted user identityelement 342 to the third party entity 500. At 680, the third partyentity 500 transmits an identity validation request to the identitysource 400. At 690, the identity source 400 determines if the identityof the user is confirmed/validated or not confirmed/not validated. At698, the identity source 400 transmits a communication to the thirdparty 500. The communication may be a validation if the identity source400 determines that the identity of the user device is confirmed. Or,the communication may inform the third party entity 500 that theidentity of the user device is not confirmed.

Referring to FIG. 6B, registering their biometric signature 206 with theidentity source 400, at 610 includes at 612, transmitting theirbiometric signature to the identity source 400. Transmitting avalidation request to the identity source, at 680 includes at 682B,transmitting the encrypted user identity element 342 to the identitysource 400. Confirming/validating or not confirming/validating theidentity of the user of the user device 200, at 690 includes at 692B,decrypting the user identity element 342 and at 694B comparing thebiometric imprint on the user identity element 342 with the registeredbiometric signature 206 stored in the identity source 400.

Referring to FIG. 6C, in the alternative embodiment described above andillustrated in FIG. 4 , storing the encrypted user identity element 342in the secure enclave 204 of the user device 200, at 640C, also includesstoring the encrypted entity element 502 in the secure enclave 204 ofthe user device 200. In addition, transmitting a validation request tothe identity source, at 680 not only includes at 682C, transmitting theencrypted user identity element 342 to the identity source 400, but alsotransmitting the encrypted entity element 502 to the identity source400. Still further, confirming/validating or not confirming/validatingthe identity of the user of the user device 200, at 690 includes at692C, not only decrypting the user identity element 342, but alsodecrypting the encrypted entity element 502. And at 694C, comparing notonly the biometric imprint on the user identity element 342 with theregistered biometric signature 206 stored in the identity source 400,but also comparing the biometric imprint on the encrypted entity element502 with the registered biometric signature 206 stored in the identitysource 400.

The innovative identity management system disclosed herein providesseveral advantages over current identity/authentication systemsmentioned above. For example, the innovation creates a consumer focused,shared authentication platform native to the financial servicesindustry. In addition, the innovation uses a financial institution (FI)authorized multi-factor authentication where there is no reliance onusername/password systems. Still further, the innovative systemfacilitates the sharing of relevant metadata in real-time to aggregate,correlate and ultimately prevent unauthorized access and continuouslyfreshens customer data through a centralized hub of trusted sources. Forexample, a red flag raised at Bank A will be available to Bank B atcritical moments. The innovation uses data analytics to identifyanomalous behavior across institutions to proactively guard againstaccount takeover, bust out and other threats and integrates seamlesslywith FI mobile apps and FI website logins.

Another advantage is that the innovative system is tokenized, which isan effective, mature control for protecting customer data and all dataexchanges. The system can be fully controlled and operated by thefinancial services industry and the customer data remains owned by theindividual financial institution. In addition, .BANK and .INSURANCEprovide an opportunity to connect a vetted and trusted community wherethey may retain backwards compatibility to legacy .COM web propertiesprovided they meet eligibility requirements.

One or more implementations include a computer-readable medium includingprocessor-executable instructions configured to implement one or moreembodiments presented herein. An embodiment of a computer-readablemedium or a computer-readable device devised in these ways isillustrated in FIG. 7 , wherein an implementation 700 includes acomputer-readable medium 702, such as a CD-R, DVD-R, flash drive, aplatter of a hard disk drive, and so forth, on which is encodedcomputer-readable data 704. The computer-readable data 704, such asbinary data including a plurality of zero's and one's as illustrated, inturn includes a set of computer instructions 706 configured to operateaccording to one or more of the principles set forth herein.

In the illustrated embodiment 700, the processor-executable computerinstructions 706 may be configured to perform a method 708, such as themethods disclosed herein. In another embodiment, theprocessor-executable instructions 704 may be configured to implement asystem, such as the systems disclosed herein. Many suchcomputer-readable media may be devised by those of ordinary skill in theart that are configured to operate in accordance with the techniquespresented herein.

As used in this application, the terms “component”, “module,” “system”,“interface”, and the like are generally intended to refer to acomputer-related entity, either hardware, a combination of hardware andsoftware, software, or software in execution. For example, a componentmay be, but is not limited to being, a process running on a processor, aprocessor, an object, an executable, a thread of execution, a program,or a computer. By way of illustration, both an application running on acontroller and the controller may be a component. One or more componentsresiding within a process or thread of execution and a component may belocalized on one computer or distributed between two or more computers.

Further, the claimed subject matter may be implemented as a method,apparatus, or article of manufacture using standard programming orengineering techniques to produce software, firmware, hardware, or anycombination thereof to control a computer to implement the disclosedsubject matter. The term “article of manufacture” as used herein isintended to encompass a computer program accessible from anycomputer-readable device, carrier, or media. Of course, manymodifications may be made to this configuration without departing fromthe scope or spirit of the claimed subject matter.

FIG. 8 and the following discussion provide a description of a suitablecomputing environment to implement embodiments of one or more of theaspects set forth herein. The operating environment of FIG. 8 is merelyone example of a suitable operating environment and is not intended tosuggest any limitation as to the scope of use or functionality of theoperating environment. Example computing devices include, but are notlimited to, personal computers, server computers, hand-held or laptopdevices, mobile devices, such as mobile phones, Personal DigitalAssistants (PDAs), media players, and the like, multiprocessor systems,consumer electronics, mini computers, mainframe computers, distributedcomputing environments that include any of the above systems or devices,etc.

Generally, embodiments are described in the general context of “computerreadable instructions” being executed by one or more computing devices.Computer readable instructions may be distributed via computer readablemedia as will be discussed below. Computer readable instructions may beimplemented as program modules, such as functions, objects, ApplicationProgramming Interfaces (APIs), data structures, and the like, thatperform one or more tasks or implement one or more abstract data types.Typically, the functionality of the computer readable instructions arecombined or distributed as desired in various environments.

FIG. 8 illustrates a system 800 that may include a computing device 802configured to implement one or more embodiments provided herein. In oneconfiguration, the computing device 802 may include at least oneprocessing unit 804 and at least one memory 806. Depending on the exactconfiguration and type of computing device, the at least one memory 806may be volatile, such as RAM, non-volatile, such as ROM, flash memory,etc., or a combination thereof. This configuration is illustrated inFIG. 8 by dashed line 808.

In other embodiments, the device 802 may include additional features orfunctionality. For example, the device 802 may include additionalstorage such as removable storage or non-removable storage, including,but not limited to, magnetic storage, optical storage, etc. Suchadditional storage is illustrated in FIG. 8 by storage 810. In one ormore embodiments, computer readable instructions to implement one ormore embodiments provided herein are in the storage 810. The storage 810may store other computer readable instructions to implement an operatingsystem, an application program, etc. Computer readable instructions maybe loaded in the at least one memory 806 for execution by the at leastone processing unit 804, for example.

Computing devices may include a variety of media, which may includecomputer-readable storage media or communications media, which two termsare used herein differently from one another as indicated below.

Computer-readable storage media may be any available storage media,which may be accessed by the computer and includes both volatile andnonvolatile media, removable and non-removable media. By way of example,and not limitation, computer-readable storage media may be implementedin connection with any method or technology for storage of informationsuch as computer-readable instructions, program modules, structureddata, or unstructured data. Computer-readable storage media may include,but are not limited to, RAM, ROM, EEPROM, flash memory or other memorytechnology, CD-ROM, digital versatile disk (DVD) or other optical diskstorage, magnetic cassettes, magnetic tape, magnetic disk storage orother magnetic storage devices, or other tangible and/or non-transitorymedia which may be used to store desired information. Computer-readablestorage media may be accessed by one or more local or remote computingdevices (e.g., via access requests, queries or other data retrievalprotocols) for a variety of operations with respect to the informationstored by the medium.

Communications media typically embody computer-readable instructions,data structures, program modules, or other structured or unstructureddata in a data signal such as a modulated data signal (e.g., a carrierwave or other transport mechanism) and includes any information deliveryor transport media. The term “modulated data signal” (or signals) refersto a signal that has one or more of its characteristics set or changedin such a manner as to encode information in one or more signals. By wayof example, and not limitation, communication media include wired media,such as a wired network or direct-wired connection, and wireless mediasuch as acoustic, RF, infrared and other wireless media.

The device 802 may include input device(s) 812 such as keyboard, mouse,pen, voice input device, touch input device, infrared cameras, videoinput devices, or any other input device. Output device(s) 814 such asone or more displays, speakers, printers, or any other output device maybe included with the device 802. The input device(s) 812 and the outputdevice(s) 814 may be connected to the device 802 via a wired connection,wireless connection, or any combination thereof. In one or moreembodiments, an input device or an output device from another computingdevice may be used as the input device(s) 812 and/or the outputdevice(s) 814 for the device 802. Further, the device 802 may includecommunication connection(s) 816 to facilitate communications with one ormore other devices, illustrated as a computing device 818 coupled over anetwork 820.

One or more applications 822 and/or program data 824 may be accessibleby the computing device 802. According to some implementations, theapplication(s) 822 and/or program data 824 are included, at least inpart, in the computing device 802. The application(s) 822 may include analgorithm 826 that is arranged to perform the functions as describedherein including those described herein. The program data 824 mayinclude commands and information 828 that may be useful for operationwith the system and method disclosed herein.

Although the subject matter has been described in language specific tostructural features or methodological acts, it is to be understood thatthe subject matter of the appended claims is not necessarily limited tothe specific features or acts described above. Rather, the specificfeatures and acts described above are disclosed as example embodiments.

Various operations of embodiments are provided herein. The order inwhich one or more or all of the operations are described should not beconstrued as to imply that these operations are necessarily orderdependent. Alternative ordering will be appreciated based on thisdescription. Further, not all operations may necessarily be present ineach embodiment provided herein.

As used in this application, “or” is intended to mean an inclusive “or”rather than an exclusive “or.” Further, an inclusive “or” may includeany combination thereof (e.g., A, B, or any combination thereof). Inaddition, “a” and “an” as used in this application are generallyconstrued to mean “one or more” unless specified otherwise or clear fromcontext to be directed to a singular form. Additionally, at least one ofA and B and/or the like generally means A or B or both A and B. Further,to the extent that “includes”, “having”, “has”, “with”, or variantsthereof are used in either the detailed description or the claims, suchterms are intended to be inclusive in a manner similar to the term“comprising”.

Further, unless specified otherwise, “first,” “second,” or the like arenot intended to imply a temporal aspect, a spatial aspect, an ordering,etc. Rather, such terms are merely used as identifiers, names, etc. forfeatures, elements, items, etc. For example, a first channel and asecond channel generally correspond to channel A and channel B or twodifferent or two identical channels or the same channel. Additionally,“comprising,” “comprises,” “including,” “includes,” or the likegenerally means comprising or including.

Although the disclosure has been shown and described with respect to oneor more implementations, equivalent alterations and modifications willoccur based on a reading and understanding of this specification and theannexed drawings. The disclosure includes all such modifications andalterations and is limited only by the scope of the following claims.

What is claimed is:
 1. A system, comprising: a processor coupled to a memory that includes instructions, that when executed by the processor, cause the processor to: request a biometric signature for a user from a user device; generate a first encrypted token based at least in part on the biometric signature; return the first encrypted token to the user device that saves the first encrypted token to a secure location on the user device accessible by biometric authentication of the user on the user device; determine whether a user identity can be confirmed based on the first encrypted token and a second encrypted token in conjunction with a validation request from a third party, the second encrypted token generated by the third party, saved on the user device, and specific to the third party, wherein the first encrypted token and the second encrypted token comprise the biometric signature of the user; and communicate whether the user identity was confirmed or unconfirmed in response to the validation request.
 2. The system of claim 1, the instructions further cause the processor to decrypt the first encrypted token and compare the biometric signature of the first encrypted token with the biometric signature of the user to determine whether the user identity is confirmed.
 3. The system of claim 1, the instructions further cause the processor to communicate data regarding the user with confirmation of the user identity.
 4. The system of claim 3, wherein data comprises at least one of a credit score, credit history, or risk score.
 5. The system of claim 1, wherein the biometric signature is associated with one of a fingerprint or facial features.
 6. The system of claim 1, wherein the system is shared by multiple financial institutions to confirm user identity.
 7. A method, comprising: requesting a biometric signature for a user from a user device; generating a first encrypted token based at least in part on the biometric signature; providing the first encrypted token to the user device that saves the first encrypted token to a secure location on the user device accessible by biometric authentication of the user on the user device; determining whether a user identity can be confirmed based on the first encrypted token and a second encrypted token in conjunction with an authentication request from a third party, the second encrypted token generated by the third party, saved on the user device, and specific to the third party, wherein the first encrypted token and the second encrypted token comprise the biometric signature of the user; and communicating whether the user identity was confirmed or unconfirmed in response to the authentication request.
 8. The method of claim 7, further comprising: decrypting the first encrypted token to reveal the biometric signature of the first encrypted token; and comparing the biometric signature of the first encrypted token with the biometric signature of the user to determine whether the user is confirmed.
 9. The method of claim 7, further comprising communicating data regarding the user with confirmation of the user identity.
 10. The method of claim 9, further comprising communicating a risk score associated with the user with confirmation of the user identity.
 11. The method of claim 7, further comprising: decrypting the first encrypted token and the second encrypted token to reveal the biometric signatures; and comparing the biometric signatures to the biometric signature of the user; and confirming the user identity when the biometric signatures match the biometric signature of the user.
 12. A method comprising: executing, on a processor, instructions that cause the processor to perform operations comprising: requesting a biometric signature of a user from a user device; generating a first encrypted token based at least in part on the biometric signature; providing the first encrypted token to the user device that saves the first encrypted token to a secure location on the user device accessible by biometric authentication of the user on the user device; decrypting the first encrypted token and a second encrypted token in conjunction with an authentication request from a third party to reveal biometric signatures, the second encrypted token generated by the third party, saved on the user device, and specific to the third party, wherein the first encrypted token and the second encrypted token comprise the biometric signature of the user; confirming an identity of the user when the biometric signatures match the biometric signature of the user; and communicating confirmation of the identity of the user in response to the authentication request.
 13. The method of claim 12, the operations further comprising communicating data regarding the user with the confirmation of the identity of the user.
 14. The method of claim 13, the operations further comprising communicating a risk score of the user with the confirmation of the identity of the user. 